This has opened so many attack vectors than it closed. For example you no longer need to hack a database to get user data. Just impersonate and request the data

This has opened so many attack vectors than it closed. For example you no longer need to hack a database to get user data. Just impersonate and request the data from target company. Cookie law trained people to click anything without reading and people don't understand what they do online. Then data portability will enable more pii in circulation. For example fake social network enables Facebook account import for prizes and so on. Now GDPR emails train people to mindlessly signup and agree to whatever. Just create fake email asking to sign up to copy of a target site. Obtain password and download all data. Furthermore employees will have easy access to neatly packaged user data, so that they can sell it in the site. This law is hackers wet dream.